Differences Between Defence in Depth for Computer Security and Physical Protection

Defence-in-depth is used today in many contemporary defensive physical security designs. The term is also used in computer security but this paper will show that there are important distinctions in the way that the concept of defence-in-depth applies for the defence of networked digital technology. Physical defence-in-depth is designed such that the adversary will be delayed and detected and potentially defeated at successive boundaries, offering the defender sufficient time to respond. This paper will show that this assumption about defence-in-depth may not apply to computer security. Given that current computer security detection methods cannot reliably detect all cyber-attacks, the most sophisticated adversary is unlikely to be detected at key boundaries. Consequently, the notion of delaying the attacker has less relevance because the defender cannot rely on that time to muster his resources. Also, this paper will illustrate how the nature of a cyber-attack – particularly blended / hybrid attacks – can provide the means to attack those security boundaries in a different sequence, not necessarily starting from the outside and tackling successive defences. This paper will consider five key differences between the environments for physical security and computer security, to then develop some parameters for effective defence-in-depth for networked digital technologies in order to provide resilience against attacks, in the context of rapidly changing digital technology, threats and business drivers. The paper will conclude with observations about what this may mean for the civil nuclear sector. (author)